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DETAILED ACTION 

1. Claims 1-10 and 12-20 are pending. 

Claim Objections 

2. Claim 1 is objected to: in line 4 wherein "said information" should be changed to "said 
some personal information" 

3. Claim 1 is objected to: in line 8 wherein "that additional personal information" should be 
corrected. It is not clear if it is the same additional information as line 7 wherein "additional 
personal information" If it is the same "that" should be changed with "said" Appropriate 
correction is required. 

Response to Amendment 

4. The objection to claim 1 and 1 1 is withdrawn in view of applicant's amendments. 

Response to Argument on 03/19/2009 

5. Applicant's amendments and arguments are fully considered but are not persuasive for 
some and new grounds of rejection is/are presented for some. 

Regarding the Double Patenting arguments, Examiner respectfiilly submits that the 
Office Action provided an analysis of the claims to support the rejection. Furthermore, the 
language of the patent is more specific than that of the instant application and therefore the 
claims are not patentably distinct. Moreover, both inventions are regarding managing 
information (health data/personal information) of a person (patient/individual) securely and/or 
the person's information is released when the person authorizes the release ("request 
electronically authenticated to be authorized by the patient"/ "to not release information . . . 
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without receiving authorization from said individual"). Therefore the nonstatutory obviousness- 
type double patenting rejection as being unpatentable over claims 1-19 of US patent 6804787 is 
appropriate and the rejection is maintained. Nevertheless, the instant and copending application 
are regarding managing data (business data/personal information) in compliance with privacy 
and release of data requires an approval ("determining whether the consent of the individual has 
been obtained, wherein the releasing of the requested information to the requestor is performed 
...if the consent of the individual has been obtained when the consent is required"/ "if the 
requested information is not subject to the requirement, releasing the requested information to 
the requestor"). Therefore, argument is not persuasive, the nonstatutory obviousness-type double 
patenting as being unpatentable over copending application 1 1057097 is maintained. 

Regarding argument Bjorksten failure to teach presenting said information and the 
sources of said information over the wide area computer network to said to individual to review 
and verify the information's accuracy" remark page 18, as recited in claim 15, is not persuasive 
because the master profile that contains, eg. fig. 2, different sources of said information 
(Amazon(l), Amazon(2), citybank, ebanking.com... was presented to the user and the user 
changing the profile by checking/verifying which ones to keep or replace new (par. 40-41, 48, 
122, 99 and figs. 2, 8, and 16) and also the user is provided with address(s) of second 
party/stores webservers identifying information and grants access to the personal profile 
by sending an indication to the trusted party then to the second party/stores webservers 
(see par. 97-98). 
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Regarding argument Bjorksten failure to teach accepting commentary on the accuracy of 
said the information based on the review from the individual over the wide area network 
computer" remark page 18 and 21, as recited in independent claims, argument is not persuasive 
because the user profile as shown on fig. 2 is checked/verified by the user and changed via 
network fig. 1 (see par. 40-41, 48, 122, 99 and fig. 16). Argument Bjorksten does not teach 
"commentary on the accuracy" is not persuasive because Bjorksten does 
annotate/change/adds data to the profile by viewing and checldng/verifying which ones to 
keep or not (see par. 40, 48, 122, flg. 16, par. 30, 99 and claim 8). 

Regarding argument Bjorksten failure to teach "presenting said selected portions of said 
information over said wide area computer network to said authorized individual along with 
identification of said sources of said selected portions of said information and any commentary 
on the accuracy of said selected portions of said information provided by said individual; and 
providing access to said database and said commentary to third parties" remark page 19, as 
recited in claim 15, argument is not persuasive because presenting said selected portions of said 
information over said wide area computer network (fig. 1) to said authorized individual (see fig. 
12) along with identification of said sources (eg. par. 0086) of said selected portions of said 
information (par. 97-98 and 40-41) and any commentary (par. 85, 97-98 and 40-46) on the 
accuracy of said selected portions of said information provided by said individual (97-98 and 40- 
46); and providing access to said database and said commentary to third parties (par. 39-46, 97- 
98 and figs. 7-9 and 13A-B). 



Double Patenting 
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6. The nonstatutory double patenting rejection is based on a judicially created doctrine 
grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or 
improper timewise extension of the "right to exclude" granted by a patent and to prevent possible 
harassment by multiple assignees. A nonstatutory obviousness-type double patenting rejection is 
appropriate where the conflicting claims are not identical, but at least one examined application 
claim is not patentably distinct from the reference claim(s) because the examined application 
claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g.. 
In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 1 1 F.3d 1046, 29 
USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re 
Van Omum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 
619 (CCPA 1970); and In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969). 

7. A timely filed terminal disclaimer in compliance with 37 CFR 1 .321 (c) or 1 .321 (d) may 
be used to overcome an actual or provisional rejection based on a nonstatutory double patenting 
ground provided the conflicting application or patent either is shown to be commonly owned 
with this application, or claims an invention made as a result of activities undertaken within the 
scope of a joint research agreement. Effective January 1, 1994, a registered attorney or agent of 
record may sign a terminal disclaimer. A terminal disclaimer signed by the assignee must fiilly 
comply with 37 CFR 3.73(b). 

8. Claims 1-20 are rejected on the ground of nonstatutory obviousness-type double 
patenting as being unpatentable over claims 1-19 of U.S. Patent No. 6,804,787. 
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9. Although the conflicting claims are not identical, they are not patentably distinct from 



each other because the instant case, all elements of claims 1-13 correspond to the claims 1-19 of 

the patent claims and encompass the scope of claims 1-13 of the instant application. 

The differences are underlined as an example in claim 1 . The differences are discussed. 
However the claims as a whole are equivalent. 



Instant Application 



Patent No. 6,804,787 



1 . A method for controlling a release of personal information 

comprising: 

depositing some personal information regarding an 
individual with a server : accepting comment^ on the 

accuracy of said information based on review from said 
individual, wherein said commentary includes explanations 
of incorrect infomiation on said server; 
obligating organizations that possess additional personal 
information regarding said individual to not disclose that 
additional personal information without authorization from 
said server; and 

instructing said server to not release said some pcrscmal 
infoiTnation held on the server and to not authorize release of 
said additional personal information at the obligated 
organizations without receiving authorization from said 
individual . 

2. Claim wherein the server is internet accessible. 
3. 

(previously presented) The method of claim 1, huther 
comprising using web 

crawler programs to locate and retrieve pubhcly-available 
information regarding said individual from a plurality of 
Internet-accessible sources 



(original) The method of claim 1 wherein said individual is a 
member of a 
database service. 
5. 

(original) The method of claim 1 wherein said personal 
information comprises 
database entries. 
6. 

(original) The method of claim 1 wherein said obligated 

organizations are 

subscribers to a database service. 



(currently amended) A method for creating a database of 
verified personal information comprising: 



1 . In a system that includes a computer device, a method for managing 
healthcare data in compliance with regulated privacy, security, and electronic 
transaction standards, the method comprising: receiving from a requestor a 
request for healthcare information relating to a natient . wherein any request 
is received through a single point of entry regardless of whether the request 
is from a requestor internal or external to a given liealllicare facility; 
retrieving tlie requested heallhcare inl'onnation; assembling a report, whereii 
the report includes: the requested healthcare information; any comments of 
the 

patient received at a gatekeeper system regarding the requested healthcare 
information; and an audit trail; and transmitting a copy of the report to the 
requestor tlirough a single point of exit regardless of whether the request was 
from a requestor internal or external to the given healthcare facility. 

2. A method as recited in claim 1 , wherein the request elecfronicallv 
authenticated to be authorized bv the patient. 

3. A method as recited in claim 1 , fiirther comprising the step for 
detennining whether patient authorization exists for responding to the rcqucs 
wherem if authorization from the patient has not been obtained, performing 
the 

step for obtaining authorization from the patient to provide the requested 
healthcare information. 

4. A method as recited in claim I, wherein the copy of the report includes 
patient specific healthcare information. 

5. A method as recited in claim 1 , further comprising the step for 
determining whether to provide de-identifled healthcare information in 
response 

to the request, wherein if de-identified healthcare information is to be 
provided, perfomiing the step for de-identifying the requested healthcare 
information. 

6. A method as recited in claim 5, wherein the copy of the report includes 
de-identified healthcare infomiation. 

7. A method as recited in claim 1, fiirther comprising the step for 
selectively performing a review of the report. 

8. A method as recited in claim 1, further comprising the step for 
selectively encrypting the report. 

9. A method as recited in claim 1, further comprising the step for 
selectively archiving the report. 
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gathering information regarding an individual; 
presenting said information over a wide area computer 
network to said individual to review and verify said 
information's accuracy; 

accepting commentary on the accuracy of said information 
based on said review from said individual over the wide area 
computer network, wherein said commentary includes 
explanations of incorrect information in said database; 
including said commentary in said database with said 
information; 

receiving a request over said wide area computer network 
from an authorized individual to review selected portions of 
said information; 

presenting said request to said individual for authorization; 
presenting said selected portions of said information over 
said wide area computer network to said authorized 

individual; and 

providing access to said database and said commentaiy to 
third parties. 



(previously presented) The method of claim 7, wherein said 

wide area computer 
network is an internet. 



(previously presented) The method of claim 7, wherein said 

the step of jialhcrinsi 

information further comprises using web crawler programs to 
locale and retrieve publicly- available information regarding 
said individual from a plurality of Internet-accessible 
sources. 

10. (original) The method of claim 7 wherein said individual 
is a member of a database service. 

1 1 . (canceled) 

12. (original) The method of claim 7 wherein said third 
parties are subscribers to a database service. 

13. (original) The method of claim 7 wherein said authorized 
individuals are members of a database service. 

14. (previously presented) The method of claim 1, wherein 
obligating organizations that possess additional personal 
information regarding said individual to not disclose that 
additional personal information without authorization from 
said server comprises: 

receiving a disclosure from said individual at said server 
identifying said organizations that possess said additional 
personal information 

contacting said organizations that possess said additional 
personal information with said server; and 
receiving a contractual agreement from said organizations 
that possess said additional personal information to not 
release said additional personal information to third parties 
without first contacting said server for authorization. 



10. A method as recited in claim 9, wherein the report is 
automatically 

archived for a period of time set by a regulation. 

1 1 . A system for managing healthcare data in compliance with 
regulated privacy, security, and electronic transaction standards, the 
system comprising: 

a computer system comprising: a gatekeeper system having: a single 
point of entry that is configured to selectively receive a request for 
healthcare information relating to a patient, wherein all requests are 
received through the single point of entry regardless of whether a 
requestor is internal or external to a given healthcare system facility; 
and a single point of exit that is configured to selectively provide a 
report in response to the request regardless of whether the requestor i; 
internal or external to the given healthcare system facility, wherein th 
report includes the requested healthcare information relating to the 
patient, any comments of the patient received at the gatekeeper syster 
regarding the requested healthcare information, and an audit trail; an 
at least one data source in communication with the computer system, 
wherein the at least one data sources comprises at least a portion of tl 
requested healthcare information. 

12. A system as recited in claim 11, wherein the computer system 
includes an interface engine. 

13. A system as recited in claim 11, wherein the request is an 
electronic request. 

14. A computer program product for implementing within a 
computer system a method for managing data in compliance with 
regulated privacy, seciuity, and electronic transaction standards, the 
computer program product comprising: a computer readable medium 
for providing computer program code means utilized to implement th 
method, wherein the computer program code means is comprised of 
executable code for implementing the steps for: receiving from a 
requestor a request for healthcare information relating to a patient, 
wherein any request is received through a single point of entry 
regardless of whether the request is from a requestor internal or 
external to a given healthcare facility; retrieving the requested 
healthcare information; assembling a report, wherein the report 
includes: the requested healthcare information; any comments of the 
patient received at a gatekeeper system regarding the requested 
healthcare information; and an audit trail; and transmitting a copy ol 
the report to the requestor through a single point of exit regardless of 
whether the request was from a requestor internal or external to the 
given healthcare facility. 

15. A computer program product as recited in claim 14, wherein th 
computer program code means flirther comprises executable code for 
implementing the steps for: determining whether authorization from 
the patient exists for responding to the request; and if the 
authorization from the patient does not exist, obtaining electronic 
authorization from the patient to provide the requested information. 
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15. (currently amended) A method for creating and sharing a 
database of verified personal information comprising: 
automatically gathering information regarding an individual 
from a plurality of information sources not controlled by the 
individual over a wide area computer network; 
presenting said information and the sources of said 
information over the wide area computer network to said 
individual to review and verify said information's accuracy; 
accepting commentary on the accuracy of said information 
based on said review from said individual over the wide area 
computer network; 

including said commentay in said database with said 
information; 

receiving a request over said wide area computer network 
from an authorized individual to review selected portions of 
said information; 

presenting said request to said individual for authorization; 
presenting said selected portions of said information over 
said wide area computer network to said authorized 
individual along with identification of said sources of said 
selected portions of said information and any commentary on 
the accm acy of said selected portions of said information 
provided by said individual; and 

providing access to said database and said commentary to 
third parties. 

16. (previously presented) The method of claim 15, fiirther 

comprising: 

supplementing said information regarding the individual by a 
continuous gathering process; 

notifying said individual of updates to said information 
located by said continuous gathering process; and 
accepting further commentary on the accuracy of said 
updates to said information from said individual over the 
wide area computer network. 

17. (previously presented) The method of claim 15, fUrther 
comprising: 

receiving a search of said database from a third party that 
results in information about said individual being displayed 
to said third party; and 

notifying said individual of said search and said display. 

18. (previously presented) The metiiod of claim 15, fUrther 

comprising: 

receiving additional information from said individual over 

the wide area computer network; and 

receiving a designation from said individual designating said 
additional information as 
one of: 

information to be made available to all subscribers of said 
database; and information to be released only upon specific 
authorization of said individual. 

19. (previously presented) The method of claim 15, wherein 
the commentary on the acciuacy of said information 



16. A computer program product as recited in claim 14, wherein th 
computer program code means further comprises executable code for 
implementing the steps for: determining whether to provide de- 
identified healthcare information in response to the request; and if de 
identified healthcare information is to be provided, de-identifying the 
requested healthcare information. 

17. A computer program product as recited in claim 14, wherein th 
computer program code means fluther comprises executable code for 
implementing the step for selectively encrypting the report. 

18. A computer program product as recited in claim 14, wherein th 
computer program code means further comprises executable code for 
implementing the step for selectively archiving the report. 

19. A computer program product as recited in claim 14, wherein th 
computer program code means fiirther comprises executable code for 
automatically implementing the step for archiving the report for a 
period of time set by a regulation. 
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comprises an indication that a portion of said information is 
incorrectly associated with said individual. 

20. (previously presented) The method of claim 15, further 
comprising requiring said third parties to register with said 

database and present said database with identifying 
information prior to providing access to said database and to 

said commentary to said third parties. 

10. The instant application generally claims a method for controlling a release of personal 
information. 

1 1 . Patent 6,804,787 claims similar limitations except "health information", "a requester", 
"patient", "a single point entry/exit", and "request electronically authenticated to be authorized 
by the patient" (see claim 1). 

12. However the instant application claims equivalent words/limitations: "personal 
information", "organizations", "individual", "server", and "to not release information ... without 
receiving authorization from said individual", respectively (see claim 1). 

13. They are equivalent because in the instant application page 19 lines 4 discloses personal 
information including medical records. Page 19 paragraph 3-page 20 paragraph 2 discloses a 
requester being a medical organization. Fig. 2 discloses a user 100 that is patient to medical 
organizations 106 and/or third party insurance company 1 12. On page 20 paragraph 1, disclosed 
each of the organization contractually agrees to first contact enterprise/server 102 before 
releasing any information about the user so the server 102 can inform and request the user 100 if 
request to release confidential information is acceptable or not. On page 10 paragraph 2 the 
instant application discloses member/user/patient receiving an electronic alert, such as email, 
when information about the member is accessed or requested and on page 20 paragraph 1 
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disclosed when confidential information request is received the user must be contacted before 
releasing access. 

14. Claims 1-13 of the instant application would have been obvious, to one ordinary skill in 
the art at the time of the invention was made over claims 1-19 of the patent 8404787 because 
using a different equivalent word does not make the application invention distinct. 

1 5 . Claims of the instant application therefore are not patentably distinct from the earlier 
patent claims and as such are unpatentable for obvious-type double patenting (In' re Goodman 
(CAFC) 29 USPQ2D 2010 (13/3/1993)). 

16. Claims 1-13 are provisionally rejected on the ground of nonstatutory obviousness- 
type double patenting as being unpatentable over claim 1-24 of copending Application No. 
11057097. 

17. Although the conflicting claims are not identical, they are not patentably distinct from 
each other because the instant case, all elements of claims 1-13 correspond to the claims of the 
copending claims and encompass the scope of claims 1-13 of the instant application. 

18. The instant application generally claims a method for controlling a release of personal 
information. 

19. The differences are discussed. However the claims as a whole are equivalent. 

20. Copending application 1 1057097 claims similar limitations except "if the requested 
information is not subject to the requirement, releasing the requested information to the 
requestor" (see claim 1). However, Copending application claims, "determining whether the 

consent of the individual has been obtained, wherein the releasing of the requested information 
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to the requestor is performed ...if the consent of the individual has been obtained when the 
consent is required" (see claim 1), which is equivalent to the instant application. 

21 . Claims 1-13 of the instant application would have been obvious, to one ordinary skill in 
the art at the time of the invention was made over claims 1-24 of copending Application No. 

1 1057097 because using a different equivalent word does not make the application invention 
distinct. 

22. This is a provisional o bviousness-type double patenting rejection because the conflicting 
claims have not in fact been patented. 

Claim Rejections - 35 USC § 103 

23. The following is a quotation of 35 U.S. C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A palcnl may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

24. Claims 15-20 are rejected under 35 U.S.C. 102(e) as being anticipated by Bjorksten 
et al (US Patent Application Publication 2003/0097451, hereinafter Bjorksten) in view of 
Satyavolu et al. USPN 6517587 B2. and Ravels, JR. 20010047282 Al. 

Regarding claim 15, Bjorksten teaches 

a method for creating and sharing a database of verified personal information comprising 
(abstract, and figs. 8 and 13 A): 

automatically gathering information regarding an individual fi-om a plurality of 
information sources over a wide area computer network (par. 46 and flgs. 1-2); 
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presenting said information and the sources of said information over the wide area 
computer network to said individual to review and verify said information's accuracy (par. 40- 
41, 48, 122, 97-99 and fig. 16; the user changing his profile shown on fig. 2 is by 
checking/verifying if he wants to keep the old profile or not); 

accepting commentary on the accuracy of said information based on said review from 
said individual over the wide area computer network (par. 40-41, 48, 122, 97-99 and fig. 16); 

including said commentary in said database with said information (par. 41-44 and 48, 
122, 97-99 and fig. 16); 

receiving a request over said wide area computer network from an authorized individual 
to review selected portions of said information (par. 40, 97-99, figs. 8 and 16 and 127); 

presenting said request to said individual for authorization (par. 40-41, 97-99, figs. 8 and 
16 and 127); 

presenting said selected portions of said information over said wide area computer 
network to said authorized individual along with identification of said sources of said selected 
portions of said information and any commentary on the accuracy of said selected portions of 
said information provided by said individual (par. 39-42, 97-99 and figs. 7-9 and 13A-B); and 

providing access to said database and said commentary to third parties (par. 41-46 and 

97-99). 

As the examiner understands, Bjorksten teaches the user browsing an internet web and 
accessing the web that gathers information regarding plurality of individuals and second party 
devices/stores as disclosed on before the user requests the trusted party and adds the second 
party/store address in the personal profile to be controlled by the user (fig. 11 element 1102 and 
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par. 85) but as the applicant amends and argues that Bjorksten fails to teach automatically 
gathering information regarding an individual from a plurality of information sources not 
controlled by the individual and the examiner combines Satyavolu for teaching automatically 
gathering information regarding an individual from a plurality of information sources not 
controlled by the individual over a wide area computer network (see col. 4 lines 36-64, col. 
2 lines 38-col. 4 lines col. 3 lines 65 and fig. 2). 

Therefore it would have been obvious to one ordinary skill in the art at the time of the 
invention was made to include the teachings of Satyavolu within the system of Bjorksten because 
they are analogous in data gathering profile database of a user and web access. One would have 
been motivated to include the teachings to provide different online information to the user and 
user protecting his personal information. 

The combination fails to disclose the commentary including explanation of incorrect 
information in the database. However Raveis discloses changing data or updating data and 
commentary regarding the change and change date or on re-issue (see claim 64, par. 183-184, 
164, and 175). 

Therefore it would have been obvious to one having ordinary skill in the art at the time of 
the invention was made to modify the teachings of Raveis within the combination system 
because they are analogous in intemet information sharing and personal information gathering. 
One would have been motivated to modify the teachings to provide reasoning why change is 
necessary and explain what, when and who made the changes. It is well known that commentary 
would explain things or reasons better. 
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Regarding claim 16, Bjorksten teaches 

supplementing said information regarding the individual by a continuous gathering 
process (par. 41-46); 

notifying said individual of updates to said information located by said continuous 
gathering process (par. 45-48); and 

accepting further commentary on the accuracy of said updates to said information from 
said individual over the wide area computer network (par. 45-49). 

Regarding claim 17, Bjorksten teaches receiving a search of said database from a third 
party that results in information about said individual being displayed to said third party; and 
notifying said individual of said search and said display (par. 61-64). 

Regarding claim 18, Bjorksten teaches receiving additional information from said 
individual over the wide area computer network (par. 61-64); and receiving a designation from 
said individual designating said additional information as one of: information to be made 
available to all subscribers of said database; and information to be released only upon specific 
authorization of said individual (par. 40-42, 61-64). 

Regarding claim 19, Bjorksten teaches wherein the commentary on the accuracy of said 
information comprises an indication that a portion of said information is incorrectly associated 
with said individual (par. 67-70). 

Regarding claim 20, Bjorksten teaches requiring said third parties to register with said 
database and present said database with identifying information prior to providing access to said 
database and to said commentary to said third parties (par. 36-38 and 96-98). 
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25. Claims 1-6 and 14 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Shelton USPN 7,028,049 Bl in view of Coleman PG Pub 2004/0139025 Al. and Ravels, JR. 
20010047282 Al. 

Regarding claim 1, Shelton discloses 

a method for controlling a release of personal information (col. 4 lines 53-58, col. 8 lines 
1-4, col. 3 lines 44-col. 4 lines 24 and col. 16 lines 32-63; controlling release of patient's 
confidential medical records by requiring patient's authorization anytime access is 
requested) comprising: 

depositing some personal information regarding an individual with an server (col. 3 lines 
66-col. 4 lines 2, col. 9 lines 40-45, col. 5 lines 1-9 and fig. 1 elements 13 and 21; plurality of 
patients medical data stored in a database); 

organizations (col. 9 lines 9-18, col. 9 lines57-63, and fig. 1 elements lOa-c; health 
care info, users are clients, hospitals, doctors, nursing services, insurance companies...) that 
possess additional personal information regarding said individual to not disclose that additional 
personal information without authorization from said server (col. 7 lines 40-50, col. 10 lines 18- 
36, col. 9 lines 1-8, and col. 10 lines 53-col. 11 lines 45; physicians insurance companies 10b 
requiring patients confidential info, to be shared with authorized third-parties and server 
12, approval agent 16 requesting patient's approval first.., no medical document of the 
patient's is provided without patient's consent); and 

instructing said server to not release said some personal information held on the server 
and to not authorize release of said additional personal information at the organizations without 
receiving authorization from said individual (col. 11 lines 32-45, col. 8 lines 1-4; server 
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12~approyal agent 16 is instructed not to release any patient's medical records stored in the 
database 21 and indexed in a master index 13 witliout first requesting patient's approval 
for release). 

Shelton is silent about obligating organizations that possess personal information 
regarding said individual to not disclose that information without authorization from said 

enterprise/server. 

However, Coleman discloses a method of controlling and/or protecting the privacy of 
individuals' personal information (see abstract and fig. 2 element 420; protecting personal 
medical record) by obligating(col. 0041) entities (merchant, insurance companies, see par. 
0030) to protect individuals' personal information (0056-0059 and fig. 3) and providing 

individual generated restrictive notice to obligate entities (par. 0031, 0056-0059), wherein said 
protect including obligation to entities not to share, transfer, and sell personal information to 
other entities (par. 0027, 0059, and 0061). 

Therefore it would have been obvious to one having ordinary skill in the art at the time of 
the invention was made to employ the teachings of Coleman within the system of Shelton 
because they are analogous in protecting personal confidential data. One would have been 
motivated to incorporate the teachings, of obligating organizations/entities not to disclose 
individuals' confidential data, because it would restrict the organization/entities from sharing or 
transferring individuals confidential information without individual's permission. 

The combination fails to disclose the commentary including explanation of incorrect 
information in the database. However Raveis discloses changing data or updating data and 
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commentary regarding the change and change date or on re-issue (see claim 64, par. 183-184, 
164, and 175). 

Therefore it would have been obvious to one having ordinary skill in the art at the time of 
the invention was made to modify the teachings of Raveis within the combination system 
because they are analogous in intemet information sharing and personal information gathering. 
One would have been motivated to modify the teachings to provide reasoning why change is 
necessary and explain what, when and who made the changes. 

Regarding claim 2, Shelton discloses the method, wherein said enterprise/server is 
Intemet- accessible (col. 9 lines 19-32 and lines 41-45). 

Regarding claim 3, Shelton discloses the method, further comprising using WebCrawler 
programs to locate and retrieve publicly-available information regarding said individual from a 
plurality of Internet-accessible sources (col. 16 lines 64-col. 17 lines 12; web robot). 

Regarding claim 4, Shelton discloses the method wherein said individual is a member of 
a database service (col. 3 lines 66-col. 4 lines 2, col. 9 lines 40-45, col. 5 lines 1-9 and flg. 1 
elements 13 and 21). 

Regarding claim 5, Shelton discloses the method wherein said personal information 
comprises database entries (col. 3 lines 66- col. 4 lines 2, and fig. 1 elements 13 and 21). 

Regarding claim 6, Shelton discloses the method wherein said obligated organizations 
are subscribers to a database service (col. 9 lines 57-col. 10 lines 4 and col. 5 lines 33-35). 
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Regarding claim 14, Coleman further teaches the method, wherein obligating 
organizations that possess additional personal information regarding said individual to not 
disclose that additional personal information without authorization fi-om said server (0025-0032) 

and comprises: 

receiving a disclosure from said individual at said server identifying said organizations 
that possess said additional personal information (par. 0031, 0056-0059); 

contacting said organizations that possess said additional personal information with said 
server (par. 0027, 0059, and 0061); and 

receiving a contractual agreement from said organizations that possess said additional 
personal information to not release said additional personal information to third parties without 
first contacting said server for authorization (0030, 0041, 0056-0061 and fig. 3). The rational for 
combining are the same as claim 1 above. 

26. Claims 7-10 and 12-13 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Shelton USPN 7,028,049 Bl in view of Adams et al. PG Pubs 2002/0013519 Al. and 
Ravels, JR. 20010047282 Al. 

Regarding claim 7, Shelton discloses a method for creating a database of verified 
personal information (col. 4 lines 53-58, col. 8 lines 1-4, col. 3 lines 44-col. 4 lines 24 and col. 
16 lines 32-63; controlling release of patient's confidential medical records of database 21 
master index 13 by requiring patient 's verifying anytime access is requested) comprising: 
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gathering information regarding an individual (patient)(col. 3 lines 66-col. 4 lines 2, col. 
9 lines 40-45, col. 5 lines 1-9 and llg. 1 elements 13 and 21; plurality of patients medical 
data stored in a database); 

receiving a request over said wide area computer networls: (WAN see col. 9 lines 1-8) 
from an authorized individual (physicians/insurance companies 10b) to review selected 
portions of said information (col. 9 lines 57-col. 10 lines 36, and col. 10 lines 53-col. 11 lines 
45; physicians/insurance companies 10b requesting patients confidential info.); 

presenting said request to said individual (patient) for authorization (col. 11 lines 31-45, 
col. 8 lines 1-4, and col. 10 lines 53-col. 11 lines 20; server 12 approval agent 16 
indicating/presenting that a request has been made for the records selected by the 
requesting client 10 to the patient for authorization); 

presenting said selected portions (patient history, comprehensive medical records, lab 
reports, test results, prescription drug records.., see col. 7 lines 5-12) of said information over 
said wide area computer network to said authorized individual (physicians/insurance 
companies 10b) (col. 16 lines 32-63, col. 11 lines 4-53, col. 10 lines 18-35, and col. 7 lines 40- 
50); and 

providing access to said database and said commentary (patient consent/evidentiary 
documentation of the propriety) to third parties (insurance company/other doctor) (col. 7 
lines 40-50, col. 6 lines 12-15, and col. 16 lines 32-63). 

Shelton discloses presenting request to patients' medical record by email/fax. Shelton is 

silent regarding presenting said information over a wide area computer network to said 
individual (patient) to review and verify said information's accuracy; accepting commentary on 
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the accuracy of said information based on said review from said individual over the wide area 
computer network; and including said commentary in a database with said information. 

However Adams et al. discloses a secure patient test result delivery system (see 
abstract). Patient is presented information over a wide area computer network (par. 0015-0016) 
to review and verify and information's accuracy (par. 0085, 0095, 0109; patient logging online 
and editing patient database 560, ttiat contain name, unique ID, plione number, address .... 
and editing to allow release of lier/liis information to pliysicians); patient accepting 
commentary (checking release box, pars. 102-109) on the accuracy of said information based 
on said review from said individual over the wide area computer network (par. 0118; patient 
checking a medical release box via network for review by physicians) and including said 
commentary in said database with said information (0085, 0095, 0109 and 0118). 

Therefore it would have been obvious to one having ordinary skill in the art at the time of 
the invention was made to combine the teachings of Adams et al. within the system of Shelton 
because they are analogous in patient medical data protection by requiring patients approval. One 
would have been motivated to do so because a patient would review and verify his/her 
information for editing/upgrading current info, and allowing or denying access to physicians. 

The combination fails to disclose the cortmientary including explanation of incorrect 
information in the database. However Ravels discloses changing data or updating data and 
commentary regarding the change and change date or on re-issue (see claim 64, par. 183-184, 
164, and 175). 

Therefore it would have been obvious to one having ordinary skill in the art at the time of 
the invention was made to modify the teachings of Ravels within the combination system 
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because they are analogous in internet information sharing and personal information gathering. 
One would have been motivated to modify the teachings to provide reasoning why change is 
necessary and explain what, when and who made the changes. 

Regarding claim 8, Shelton discloses wherein said wide area computer network is an 
Internet (col. 9 lines 19-32 and lines 41-45). 

Regarding claim 9, Shelton discloses wherein said the step of gathering information 
further comprises using WebCrawler programs to locate and retrieve publicly- available 
information regarding said individual individuals from a plurality of Internet-accessible sources 
(col. 16 lines 64-col. 17 lines 12; webrobot). 

Regarding claim 10, Shelton discloses wherein said individual is a member of a database 
service (Shelton col. 3 lines 66-col. 4 lines 2, col. 9 lines 40-45, col. 5 lines 1-9 and fig. 1 
elements 13 and 21). 

Regarding claim 12, Shelton discloses wherein said third parties are subscribers to a 
database service (col. 7 lines 40-50). 

Regarding claim 13, SheltOn discloses wherein said authorized individuals are members 
of a database service (col.9 lines 57-col. 10 lines 4 and col. 5 lines 33-35). 

Conclusion 

27. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to ELENI A. SHIFERAW whose telephone number is (571)272- 
3867. The examiner can normally be reached on Mon-Fri 8:00am-5:00pm. 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Nasser R. Moazzami can be reached on (571) 272-4195. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/Eleni A Shiferaw/ 
Examiner, Art Unit 2436 



